Eclipse JGit prior 6.6.1 case sensitivity

Summaryinfo

A vulnerability classified as critical was found in Eclipse JGit. This vulnerability affects unknown code. The manipulation results in case sensitivity. This vulnerability is cataloged as CVE-2023-4759. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in Eclipse JGit. Affected is an unknown function. The manipulation with an unknown input leads to a case sensitivity vulnerability. CWE is classifying the issue as CWE-178. The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem. This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command. The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration. Setting git configuration option core.symlinks = false before checking out avoids the problem. The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/  and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . The JGit maintainers would like to thank RyotaK for finding and reporting this issue.

The weakness was shared 09/12/2023 as 11. The advisory is shared for download at gitlab.eclipse.org. This vulnerability is traded as CVE-2023-4759 since 09/04/2023. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 6.6.1 eliminates this vulnerability. The upgrade is hosted for download at projects.eclipse.org. Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.eclipse.org. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Eclipse

Name

• JGit

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion